docs: def p0f_getlocalsigs():
      """This function returns a dictionary of signatures indexed by p0f
  db (e.g., p0f_kdb, p0fa_kdb, ...) for the local TCP/IP stack.
  
  You need to have your firewall at least accepting the TCP packets
  from/to a high port (30000 <= x <= 40000) on your loopback interface.
  
  Please note that the generated signatures come from the loopback
  interface and may (are likely to) be different than those generated on
  "normal" interfaces."""
      pid = os.fork()
      port = random.randint(30000, 40000)
      if pid > 0:
          # parent: sniff
          result = {}
          def addresult(res):
              # TODO: wildcard window size in some cases? and maybe some
              # other values?
              if res[0] not in result:
                  result[res[0]] = [res[1]]
              else:
                  if res[1] not in result[res[0]]:
                      result[res[0]].append(res[1])
          # XXX could we try with a "normal" interface using other hosts
          iface = conf.route.route('127.0.0.1')[0]
          # each packet is seen twice: S + RA, S + SA + A + FA + A
          # XXX are the packets also seen twice on non Linux systems ?
          count=14
          pl = sniff(iface=iface, filter='tcp and port ' + str(port), count = count, timeout=3)
          map(addresult, map(packet2p0f, pl))
          os.waitpid(pid,0)
      elif pid < 0:
          log_runtime.error("fork error")
      else:
          # child: send
          # XXX erk
          time.sleep(1)
          s1 = socket.socket(socket.AF_INET, type = socket.SOCK_STREAM)
          # S & RA
          try:
              s1.connect(('127.0.0.1', port))
          except socket.error:
              pass
          # S, SA, A, FA, A
          s1.bind(('127.0.0.1', port))
          s1.connect(('127.0.0.1', port))
          # howto: get an RST w/o ACK packet
          s1.close()
          os._exit(0)
      return result